3 ms·

We are really surprised Facebook hasn't been hit with before, how do they allow running remote JavaScript execution. This should be easy to detect. Here is the

• ricefield 15y ago
  so in other words, facebook is kind of dumb for allowing remote javascript execution...
  • nodesocket 15y ago
    Well, it can be tricky, often times the XSS attack is masked quite deeply, but there are known methods. PHP strip_tags will assist, though would need to be beefed up a bit to handle the onclick, onhover, onblur, onfocus, etc events. In this particular case, simply looking for `javascript:` would have done the trick.